diff --git a/.gitignore b/.gitignore
index 566afecb..9b8aea8b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -53,7 +53,7 @@ typings/
 
 # dotenv environment variable files
 .env*
-.kratos.yml
+./docker/kratos/config/kratos.yml
 
 # gatsby files
 .cache/
diff --git a/README.md b/README.md
index 6deccfe3..68c5de96 100644
--- a/README.md
+++ b/README.md
@@ -79,8 +79,9 @@ rs.initiate(
 Most of the needed config is already under `docker/kratos`. The only two things that need to be changed are the config
 for Kratos that might contain you email server password, and the JWKS Oathkeeper uses to sign its JWT tokens.
 
-To override the default `kratos.yml` you can create ` .kratos.yml` in the root directory of the project, alongside
-the `.env` file.
+Make sure to create your own`docker/kratos/config/kratos.yml` by copying the `kratos.yml.sample` in the same directory.
+Also make sure to never add that file to source control because it will most probably contain your email password in
+plain text!
 
 To override the JWKS you will need to directly edit
 `docker/kratos/oathkeeper/id_token.jwks.json` and replace it with your generated key set. If you don't know how to
diff --git a/docker-compose.yml b/docker-compose.yml
index 284fa15c..275757b7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -241,7 +241,6 @@ services:
     volumes:
       - ./docker/kratos/config:/etc/config/kratos
       - ./docker/data/cockroach/sqlite:/var/lib/sqlite
-      - ./.kratos.yml:/etc/config/kratos/kratos.yml
       - ./docker/kratos/cr_certs:/certs
     networks:
       shared:
diff --git a/docker/kratos/config/kratos.yml b/docker/kratos/config/kratos.yml.sample
similarity index 100%
rename from docker/kratos/config/kratos.yml
rename to docker/kratos/config/kratos.yml.sample
diff --git a/setup-scripts/README.md b/setup-scripts/README.md
index bc0e8883..c6407c61 100644
--- a/setup-scripts/README.md
+++ b/setup-scripts/README.md
@@ -99,7 +99,7 @@ At this point we have almost everything running, we just need to set up your wal
 1. only for siasky.net domain instances: edit `/home/user/skynet-webportal/docker/caddy/Caddyfile`, uncomment `import siasky.net`
 1. `docker-compose up -d` to restart the services so they pick up new env variables
 1. `docker exec caddy caddy reload --config /etc/caddy/Caddyfile` to reload Caddyfile configuration
-1. add your custom Kratos configuration to `/home/user/skynet-webportal/.kratos.yml` (in particular, the credentials for your mail server should be here, rather than in your source control). For a starting point you can take `docker/kratos/config/kratos.yml`.
+1. add your custom Kratos configuration to `/home/user/skynet-webportal/docker/kratos/config/kratos.yml` (in particular, the credentials for your mail server should be here, rather than in your source control). For a starting point you can take `docker/kratos/config/kratos.yml.sample`.
 
 ## Subdomains